github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

[GH-ISSUE #1813] [private-dev] xsession-errors log is chowned by root #1232

New issue
Closed
opened 2026-05-05 07:41:51 -06:00 by gitea-mirror · 5 comments
gitea-mirror commented 2026-05-05 07:41:51 -06:00
Owner
Copy link

Originally created by @Vincent43 on GitHub (Mar 13, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1813

I noticed that in some circumstances .xsession-errors log file is getting chowned by root while using firejail. I found that private-dev option is causing such issues when using with graphical apps started from file manager on KDE plasma. I didn't bisected it but a9c3a772b7 dda8b2dbaf b21763636a are potential candidates for causing regression.

To reproduce with KDE:

  1. Open unsandboxed dolphin /usr/bin/dolphin
  2. Check .xsession-errors attributes:
ls -al .xsession-errors
-rw------- 1 user users 12833 Mar 13 14:21 .xsession-errors
  1. Create or open existing file: touch aaa.txt
  2. Open it through file manager (executing kate aaa.txt from terminal doesn't cause issues)
  3. Check .xsession-errors attributes again:
ls -al .xsession-errors
-rw------- 1 root root 12833 Mar 13 14:25 .xsession-errors

I reproduced it with kate, kwrite, okular and gwenview with firejail from git.

Originally created by @Vincent43 on GitHub (Mar 13, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/1813 I noticed that in some circumstances `.xsession-errors` log file is getting chowned by root while using firejail. I found that `private-dev` option is causing such issues when using with graphical apps started from file manager on KDE plasma. I didn't bisected it but https://github.com/netblue30/firejail/commit/a9c3a772b74ffdcdb5b871d0fd2b5277bdf88419 https://github.com/netblue30/firejail/commit/dda8b2dbaf85383c787b2e70982346779471a269 https://github.com/netblue30/firejail/commit/b21763636adc4edd63b7991908fffcdb84a048c6 are potential candidates for causing regression. To reproduce with KDE: 1. Open unsandboxed dolphin `/usr/bin/dolphin` 2. Check `.xsession-errors` attributes: ``` ls -al .xsession-errors -rw------- 1 user users 12833 Mar 13 14:21 .xsession-errors ``` 3. Create or open existing file: `touch aaa.txt` 4. Open it through file manager (executing `kate aaa.txt `from terminal doesn't cause issues) 5. Check `.xsession-errors` attributes again: ``` ls -al .xsession-errors -rw------- 1 root root 12833 Mar 13 14:25 .xsession-errors ``` I reproduced it with kate, kwrite, okular and gwenview with firejail from git.
gitea-mirror 2026-05-05 07:41:51 -06:00
  • closed this issue
  • added the
    bug
         label
gitea-mirror commented 2026-05-05 07:41:55 -06:00
Author
Owner
Copy link

@netblue30 commented on GitHub (Mar 13, 2018):

Let's mark it as a bug, we need to look into it.

<!-- gh-comment-id:372673278 --> @netblue30 commented on GitHub (Mar 13, 2018): Let's mark it as a bug, we need to look into it.
gitea-mirror commented 2026-05-05 07:41:57 -06:00
Author
Owner
Copy link

@Vincent43 commented on GitHub (Mar 13, 2018):

@netblue30 I bisected it to a9c3a772b7

<!-- gh-comment-id:372708356 --> @Vincent43 commented on GitHub (Mar 13, 2018): @netblue30 I bisected it to https://github.com/netblue30/firejail/commit/a9c3a772b74ffdcdb5b871d0fd2b5277bdf88419
gitea-mirror commented 2026-05-05 07:42:00 -06:00
Author
Owner
Copy link

@Fred-Barclay commented on GitHub (Mar 13, 2018):

Same here - Fedora 27 Cinnamon.

<!-- gh-comment-id:372743577 --> @Fred-Barclay commented on GitHub (Mar 13, 2018): Same here - Fedora 27 Cinnamon.
gitea-mirror commented 2026-05-05 07:42:01 -06:00
Author
Owner
Copy link

@netblue30 commented on GitHub (Mar 14, 2018):

Thanks guys, reverted back to the old version: ea1ba191ef

@Vincent43: I am thinking about bringing in apparmor by default in a larger number of applications, something like vlc and mpv profiles in this commit: 31550dd0b3 I would say if you still have apparmor running on your box, just put it in for all applications you have it enabled.

<!-- gh-comment-id:373069428 --> @netblue30 commented on GitHub (Mar 14, 2018): Thanks guys, reverted back to the old version: https://github.com/netblue30/firejail/commit/ea1ba191efe33edff8e03cd3d2823fec1831847e @Vincent43: I am thinking about bringing in apparmor by default in a larger number of applications, something like vlc and mpv profiles in this commit: https://github.com/netblue30/firejail/commit/31550dd0b3be41e77aab8f16d65eda42aa500d1c I would say if you still have apparmor running on your box, just put it in for all applications you have it enabled.
gitea-mirror commented 2026-05-05 07:42:02 -06:00
Author
Owner
Copy link

@Vincent43 commented on GitHub (Mar 17, 2018):

@netblue30 sorry for the delay but I was busy recently. I added more apps in d8b4a63320 .

Generally I have apparmor enabled globally in firejail and it's working good. I think we may even add it to default profile. The things which are supposed to break with apparmor currently are:

  • apps which are depending on dbus usage
  • apps which are executing binaries from non-standard directory like /home, /usr/share or /etc.

Those cases can be handled locally through /etc/apparmor.d/local/firejail-local config

<!-- gh-comment-id:373927197 --> @Vincent43 commented on GitHub (Mar 17, 2018): @netblue30 sorry for the delay but I was busy recently. I added more apps in https://github.com/netblue30/firejail/commit/d8b4a633202a13a13c75779d1f40a99d6cc51dfb . Generally I have apparmor enabled globally in firejail and it's working good. I think we may even add it to default profile. The things which are supposed to break with apparmor currently are: - apps which are depending on dbus usage - apps which are executing binaries from non-standard directory like `/home`, `/usr/share` or `/etc`. Those cases can be handled locally through `/etc/apparmor.d/local/firejail-local config`
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
serialize_remounts_v2
landlock_v4
landlock
release-0.9.64
release-0.9.62
gitlab_ci
LTSbase
fred_ctests
docs
0.9.80
0.9.80-rc1
0.9.78
0.9.76
0.9.76-rc4
0.9.76-rc3
0.9.76-rc2
0.9.76-rc1
0.9.74
landlock-split
0.9.72
0.9.72rc1
0.9.70
0.9.68
0.9.68rc1
0.9.66
0.9.66rc1
0.9.64.4
0.9.64.2
0.9.64
0.9.64rc1
0.9.62.4
0.9.62.2
0.9.62
0.9.56.2-LTS
0.9.60
0.9.60-rc1
0.9.58.2
0.9.58
0.9.58-rc1
0.9.56-LTS-release
0.9.56-LTS
0.9.56
0.9.56-rc1
0.9.54
0.9.54-rc2
0.9.54-rc1
0.9.52
0.9.38.12
0.9.50
0.9.50-rc1
0.9.48
0.9.46
0.9.46-rc1
0.9.44.10
0.9.44.8
0.9.44.6
0.9.38.10
0.9.44.4
0.9.38.8
0.9.44.2
0.9.44
0.9.44-rc1
0.9.38.4
0.9.42
0.9.42-rc2
0.9.38.2
0.9.42-rc1
disable-globalcfg
0.9.40
0.9.40-rc1
0.9.38
0.9.38-rc1
0.9.36
0.9.36-rc1
0.9.34
0.9.34-rc1
0.9.32
0.9.32-rc1
0.9.30
0.9.30-rc1
Labels
Clear labels   
LTS merge

   
LTS merge

   
bug

   
bug

   
converted-to-discussion

   
doc-todo

   
documentation

   
duplicate

   
enhancement

   
file-transfer

   
firecfg

   
firejail-in-firejail

   
firetools

   
graphics

   
help wanted

   
information_old

   
installation

   
invalid

   
modif

   
moved

   
needinfo

   
networking

   
notabug

   
notourbug

   
old-version

   
overlayfs

   
packaging

   
profile-request

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
question_old

   
removal

   
runtime-permissions

   
sandbox-ipc

   
security

   
stale

   
wiki

   
wiki

   
wontfix

   
wordpress

   
workaround
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1232
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?